Who must appoint a DPO? What does the General Data Protection Regulation (GDPR) require regarding a Data Protection Officer (or DPO)? This is one of the questions that the GDPR, adopted by the European Parliament in 2016, has prompted many organisations to ask. Another one of those questions is: What are some of the implications of those requirements for those that the GDPR applies to (those who either do business in Europe or have dealings with the personal information of European citizens)? The shortest answer to these questions is that if the GDPR applies to your business, the Data Protection Officer role is a key one to consider.

What is a Data Protection Officer (or DPO)?

Maybe people ask: what is a Data Protection Officer (or DPO)? Under the GDPR, data controllers and processors appoint a Data Protection Officer (DPO) to help them comply with data protection law. Once appointed, the officer looks into the risks that data processing can expose a business to. The officer helps the business in their attempts to avoid those risks. Basically, the officer is the link between the public (including other organisations you may work with) and your organisation for processing personal data. This means that the public can direct their data protection queries to this officer. The officer will then report directly to management and must be given all necessary resources to carry out their functions.

Who needs a Data Protection Officer?

The GDPR does NOT require every controller and processor to appoint a Data Protection Officer.

Public bodies must appoint one

The GDPR says that public bodies (except courts carrying out their normal judicial functions) must appoint a DPO. The immediate issue that arises there is: What is a public body? The GDPR does not define a public body. The Information Commissioner’s Office (ICO) suggests that apart from State-Owned Entities, and other bodies that clearly only exist as public bodies, it will be left to the national laws of Member States to determine what private bodies will also be deemed public bodies for the purposes of the GDPR.

Based on this, South African organisations will probably have to look at what the laws of the Member States whose people they process personal data about say. In other words, do those laws make it clear which organisations are always public bodies, and which are only public bodies when they serve certain functions?

Core activities involving regular processing on a large scale

Organisations are struggling to understand what the GDPR means when it requires controllers and processors whose “core activities” involve processing special categories of personal data, for example, “on a large scale” to appoint DPOs. They are also struggling to understand what the GDPR means about processing that involves regular and systematic monitoring of data subjects on a “large scale”. These organisations want to understand whether or not their processing activities fall within the ambit of that requirement.

Regular and systematic monitoring of data subjects on a large scale

The Board’s Guidelines on Data Protection Officers explain that core activities, firstly, are activities that an organisation wants to undertake in order to achieve its main goals. For example, a hospital mainly aims to provide healthcare.

When explaining the meaning of “regular and systematic monitoring,” the Working Party, using the same hospital example, states that, as a consequence of providing healthcare, the hospital will regularly and in accordance with a system collect health data. Another example to consider when explaining these words is an organisation that provides outsourced HR services to other organisations. This organisation’s core activities will focus on helping it serve as an effective HR function for other organisations. As a consequence of being such a function, the organisation will continuously and systematically process personal data.

For the term “on a large scale,” the Board explains that while it is difficult to define these words exactly, the idea is that if the processing affects a significant number of data subjects, over a large geographical area, involving various systems. Thus, the processing is most likely happening on a large scale.

The GDPR is very clear about which organisations require a Data Protection Officer. Organisations have to appoint a Data Protection officer that:

  • has core operations which include the processing of data through mass systematic and regular monitoring of data subjects; or
  • process special personal information (race, ethnicity, and biometric data) of data subjects on a large scale.

Alternatively, a private body does not have to appoint one if:

  • its main activities only seldom involve monitoring data subjects and with little infringement on those data subjects’ rights,
  • it does not process special personal information at all, or
  • it only processes the special personal information of a small group of data subjects.

One Data Protection Officer (DPO) for the Group

It is also possible, however, for organisations in a group structure to come together and appoint one even when the GDPR doesn’t require them to do so. But the Board Guidelines on Data Protection recommend that, where it isn’t entirely obvious whether the GDPR requires them to have a Data Protection Officer, organisations follow and document a step-by-step analysis of why they believe they do not need to appoint one. For the whole discussion from the Board, read the Board’s Guidelines on Data Protection Officers.

Actions you can take

  • Answer the question “what is the GDPR,” and understand what it requires from your organisation by attending a GDPR workshop or asking us to answer your questions.
  • Be well-placed to deliver on all the duties of the Data Protection Officer job by asking us to advise you.
  • Subscribe to the Michalsons newsletter to receive future updates.